Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit9450c96

Browse files
committed
ImplementonlyAllowOrigins
This funnels into the socket.io `origins` config, but only supports using an array of strings. It's also stricter in how it matches the origin against the whitelist.
1 parent50bc415 commit9450c96

File tree

4 files changed

+86
-0
lines changed

4 files changed

+86
-0
lines changed

‎lib/configure.js‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
var_=require('lodash');
66
varUrls=require('machinepack-urls');
77
varERRORPACK=require('./errors');
8+
varcheckOriginUrl=require('./util/check-origin-url');
89

910

1011

@@ -47,6 +48,26 @@ module.exports = function ToConfigure(app) {
4748
);
4849
}
4950

51+
// config.sockets.onlyAllowOrigins must be an array.
52+
if(!_.isUndefined(app.config.sockets.onlyAllowOrigins)&&!_.isArray(app.config.sockets.onlyAllowOrigins)){
53+
thrownewError('If `sails.config.sockets.onlyAllowOrigins` is defined, it must be an array of origins.');
54+
}
55+
56+
// Warn if config.sockets.onlyAllowOrigins is not defined in production.
57+
if(_.isUndefined(app.config.sockets.onlyAllowOrigins)&&process.env.NODE_ENV==='production'){
58+
app.log.warn('No `sails.config.sockets.onlyAllowOrigins` setting was detected.');
59+
app.log.warn('In a production environment, this setting is recommended for');
60+
app.log.warn('security reasons.\n');
61+
}
62+
63+
// Validate all origins in config.sockets.onlyAllowOrigins.
64+
if(_.isArray(app.config.sockets.onlyAllowOrigins)){
65+
_.each(app.config.sockets.onlyAllowOrigins,function(origin){
66+
checkOriginUrl(origin);
67+
});
68+
}
69+
70+
5071
// Adapter options
5172
// =================================
5273

‎lib/initialize.js‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
*/
44

55
varSocketIO=require('socket.io');
6+
var_=require('lodash');
67
varparseSdkMetadata=require('./parse-sdk-metadata');
78
varToHandleNewConnection=require('./on-connect');
89
varToBuildSocketsMethods=require('./sails.sockets');
@@ -95,6 +96,14 @@ module.exports = function ToInitialize(app) {
9596
if(app.config.sockets.cookie){
9697
opts.cookie=app.config.sockets.cookie;
9798
}
99+
if(app.config.sockets.onlyAllowOrigins){
100+
opts.origins=function(origin,cb){
101+
if(_.contains(app.config.sockets.onlyAllowOrigins,origin)){
102+
returncb(null,true);
103+
}
104+
returncb(null,false);
105+
};
106+
}
98107
returnopts;
99108
})());
100109

‎lib/util/check-origin-url.js‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
/**
2+
* Module dependencies
3+
*/
4+
5+
var_=require('lodash');
6+
varurl=require('url');
7+
varflaverr=require('flaverr');
8+
9+
10+
/**
11+
* checkOriginUrl()
12+
*
13+
*@param {String} originUrl
14+
* The origin URL to check.
15+
* (This is used when parsing the relevant config from within `sails.config.security`
16+
* or `sails.config.sockets`.)
17+
*
18+
*@throws {Error} if not valid
19+
*@property {String} code (==='E_INVALID')
20+
*/
21+
22+
module.exports=functioncheckOriginUrl(originUrl){
23+
24+
if(!_.isString(originUrl)||originUrl===''){
25+
throwflaverr('E_INVALID',newError('Must specify a non-empty string, but instead got: '+util.inspect(originUrl,{depth:null})));
26+
}
27+
28+
if(!originUrl.match(/^https?:\/\//)){
29+
throwflaverr('E_INVALID',newError('Must specify a protocol like http:// or https://, but instead got: '+originUrl));
30+
}
31+
32+
// Now do a mostly-correct parse of the URL.
33+
varparsedOriginUrl=url.parse(originUrl);
34+
35+
varisHttps=parsedOriginUrl.protocol==='https:';
36+
37+
if(isHttps&&parsedOriginUrl.port==='443'){
38+
throwflaverr('E_INVALID',newError('Should not explicitly specify port 443 with https:// (it is implied). But instead got: '+originUrl));
39+
}
40+
if(!isHttps&&parsedOriginUrl.port==='80'){
41+
throwflaverr('E_INVALID',newError('Should not explicitly specify port 80 with https:// (it is implied). But instead got: '+originUrl));
42+
}
43+
44+
// Ensure there is no path or query string or fragment or anything like that.
45+
if(parsedOriginUrl.pathname!=='/'||parsedOriginUrl.path!=='/'){
46+
throwflaverr('E_INVALID',newError('Should not specify a path, query string, URL fragment, or anything like that (but instead, got `'+originUrl+'`)'));
47+
}
48+
49+
// Ensure there is no trailing slice
50+
varlastCharacter=originUrl.slice(-1);
51+
if(lastCharacter==='/'){
52+
throwflaverr('E_INVALID',newError('Should not specify a trailing slash, but instead got: '+originUrl));
53+
}
54+
55+
};

‎package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
],
1111
"dependencies": {
1212
"async":"2.0.1",
13+
"flaverr":"^1.0.0",
1314
"lodash":"3.10.1",
1415
"machinepack-urls":"^3.1.1",
1516
"semver":"4.3.6",

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp